`dnf kpatch auto-filter` excludes kernels but not kernel-headers/source

[Markus92]

My system has a custom kernel module running for HPC storage. To prevent having to recompile it all the time we only use kernel versions with RHEL supported live patching. kpatch auto-filter blocks all kernel packages nicely.

Unfortunately this does not apply to other kernel-related packages, like kernel-devel, kernel-headers and kernel-tools. But installing newer versions than the currently installed kernel doesn't make a lot of sense, either.

See following output. I am currently running 5.14.0-687.10.1.el9_8.x86_64 but latest kernel in my content view is 5.14.0-687.30.1.el9_8.x86_64 which is not on the kpatch support cadence.

$ sudo dnf update
Updating Subscription Management repositories.
Red Hat Enterprise Linux 9 for x86_64 - AppStream (RPMs)                            156 kB/s | 4.5 kB     00:00
Red Hat Enterprise Linux 9 for x86_64 - Supplementary (RPMs)                        131 kB/s | 3.8 kB     00:00
Red Hat Enterprise Linux 9 for x86_64 - BaseOS (RPMs)                               146 kB/s | 4.1 kB     00:00
Red Hat CodeReady Linux Builder for RHEL 9 x86_64 (RPMs)                            152 kB/s | 4.5 kB     00:00
Please note, kpatch filter is enabled, only kpatch supported kernels are shown.
Error:
 Problem: package kernel-devel-matched-5.14.0-687.30.1.el9_8.x86_64 from rhel-9-for-x86_64-appstream-rpms requires kernel-core = 5.14.0-687.30.1.el9_8, but none of the providers can be installed
  - cannot install the best update candidate for package kernel-devel-matched-5.14.0-687.10.1.el9_8.x86_64
  - package kernel-core-5.14.0-687.30.1.el9_8.x86_64 from rhel-9-for-x86_64-baseos-rpms is filtered out by exclude filtering
(try to add '--skip-broken' to skip uninstallable packages or '--nobest' to use not only best candidate packages)

Trying with --nobest results in a total mismatch, too:

$ sudo dnf update --nobest
Updating Subscription Management repositories.
Red Hat Enterprise Linux 9 for x86_64 - AppStream (RPMs)                            162 kB/s | 4.5 kB     00:00
Red Hat Enterprise Linux 9 for x86_64 - Supplementary (RPMs)                        133 kB/s | 3.8 kB     00:00
Red Hat Enterprise Linux 9 for x86_64 - BaseOS (RPMs)                                80 kB/s | 4.1 kB     00:00
Red Hat CodeReady Linux Builder for RHEL 9 x86_64 (RPMs)                            161 kB/s | 4.5 kB     00:00
Please note, kpatch filter is enabled, only kpatch supported kernels are shown.
Dependencies resolved.

 Problem: package kernel-devel-matched-5.14.0-687.30.1.el9_8.x86_64 from rhel-9-for-x86_64-appstream-rpms requires kernel-core = 5.14.0-687.30.1.el9_8, but none of the providers can be installed
  - cannot install the best update candidate for package kernel-devel-matched-5.14.0-687.10.1.el9_8.x86_64
  - package kernel-core-5.14.0-687.30.1.el9_8.x86_64 from rhel-9-for-x86_64-baseos-rpms is filtered out by exclude filtering
====================================================================================================================
 Package                      Architecture Version                     Repository                              Size
====================================================================================================================
Installing:
 kernel-devel                 x86_64       5.14.0-687.30.1.el9_8       rhel-9-for-x86_64-appstream-rpms        22 M
Upgrading:
 kernel-abi-stablelists       noarch       5.14.0-687.30.1.el9_8       rhel-9-for-x86_64-baseos-rpms          1.0 M
 kernel-headers               x86_64       5.14.0-687.30.1.el9_8       rhel-9-for-x86_64-appstream-rpms       2.8 M
 kernel-tools                 x86_64       5.14.0-687.30.1.el9_8       rhel-9-for-x86_64-baseos-rpms          1.3 M
 kernel-tools-libs            x86_64       5.14.0-687.30.1.el9_8       rhel-9-for-x86_64-baseos-rpms          1.0 M
Skipping packages with broken dependencies:
 kernel-devel-matched         x86_64       5.14.0-687.30.1.el9_8       rhel-9-for-x86_64-appstream-rpms       991 k

Transaction Summary
====================================================================================================================
Install  1 Package
Upgrade  4 Packages
Skip     1 Package

All packages are in RHEL-supported repos like baseos and appstream so this was kinda surprising to me. Intended behavior would be to at least get kernel-devel-matched to stick to the supported versions, but preferably all kernel packages.

$ sudo dnf kpatch status
Updating Subscription Management repositories.
Red Hat Enterprise Linux 9 for x86_64 - AppStream (RPMs)                             92 kB/s | 4.5 kB     00:00
Red Hat Enterprise Linux 9 for x86_64 - Supplementary (RPMs)                         79 kB/s | 3.8 kB     00:00
Red Hat Enterprise Linux 9 for x86_64 - BaseOS (RPMs)                                90 kB/s | 4.1 kB     00:00
Red Hat CodeReady Linux Builder for RHEL 9 x86_64 (RPMs)                             96 kB/s | 4.5 kB     00:00
Please note, kpatch filter is enabled, only kpatch supported kernels are shown.
Kpatch update setting: auto-update
Kpatch filter setting: auto-filter
Dependencies resolved.
Nothing to do.
Complete!